New Forensic Tool Recovers AI Agent Activity From Computer Memory

An open-source digital-forensics tool called MCPTrace has been introduced to help investigators recover evidence of AI agent activity from computer memory.

The tool operates as a plugin for Volatility 3, a widely used memory-forensics framework. It searches Windows and Linux memory images for potential Model Context Protocol (MCP) and JSON-RPC communications.

MCP enables AI applications to interact with external tools and data sources. As these systems become more common, their activity may provide important evidence during cybersecurity investigations.

According to the project's documentation, MCPTrace can recover potential tool names, execution arguments and request-response pairs. It also records memory addresses and SHA-256 hashes while preserving the original extracted bytes for verification.

Investigators can export the recovered information in JSONL format for further examination without relying on external AI services.

The tool could help incident responders reconstruct interactions between AI agents and connected tools, particularly when investigating unauthorised commands, suspicious automation or potential data exposure.

However, recovered memory fragments do not necessarily represent complete conversations or prove that a requested action was successfully executed. Investigators must correlate the extracted records with application logs, endpoint activity and other evidence.

The release highlights an emerging area of digital forensics: examining AI agent activity through traditional memory-analysis techniques.